Privacy Policy

Platvix Ltd is a company registered in England and Wales, with its registered office at Victoria Building, Middlesbrough, United Kingdom. This policy explains how we collect, use, share, store and protect information when you visit platvix.com or use the Platvix platform, an AI fundraising service for startups.

We are the data controller for the information described here unless we say otherwise. You can reach us at privacy@platvix.com.

Two parts of this policy are for people who have never used Platvix. Section 6 is for anyone opening a deck someone shared with them. Section 7 is for anyone named in our funding directory.

The Services use AI models to read your materials, build a record of your company, research funding options and draft outreach. The models are hosted by Microsoft Azure and Google Cloud (Vertex AI) under agreements that bar them from training on your content. We do not train models on your content either.

Outputs can be incomplete, out of date or wrong. They shape what you see, and where you enable a public profile, what investors see. They carry no legal or similarly significant effect: people make the decisions, and nothing reaches anyone else unless you send it. We rely on the Article 22(1) exemption for automated decision-making on that basis.

You can ask for a description of the logic behind an output, and for human review, at privacy@platvix.com.

Platvix staff

A small number of authorised people can reach account data and content, including uploaded materials and conversations, where it is needed to provide support, operate and secure the Services, investigate abuse or comply with the law. Access follows least privilege and is logged with the person and the reason. We can tell you about administrative access to your account on request.

Your team

A Pro plan holds one owner and up to three invited members in one workspace. Members can see the workspace’s Flow conversations, including those from before they joined, which is why an invitation asks them to accept that before it completes. The owner can remove a member at any time. Conversations a removed member took part in stay in the workspace.

Partners

If you sign up through a partner or redeem a partner invite, that partner can see the status of the deal it sourced: that your startup signed up, when, and the status of the credits it provided. Partners do not see your uploaded content, your conversations, your analysis results or how you use the platform, unless you separately agree to that with the partner and with us.

Investors

If you enable a public profile, we record which registered investors view it and show that history to you in your dashboard.

Others

We do not sell your personal data. We may share data with professional advisers bound by confidentiality, with regulators or law enforcement where we are legally required to, and with a prospective buyer in a merger or acquisition, subject to confidentiality. The companies that process data on our behalf are listed in Section 8.

When you share your deck through a tracked link, we record how it is read: when it was opened, which pages were reached, how long was spent on each, and whether it was downloaded. You see this in your dashboard. If you turn on email verification, the reader enters an email address and confirms it with a code before the deck opens, and we hold that address with the session.

We also record the reader’s browser type, and their IP address where a document is downloaded, to keep links secure and to tell a person reading from an automated fetch.

You decide who receives a link and you are responsible for what you share and with whom.

Our funding directory holds records of investors, funds, grant bodies and accelerator programmes. Those records name people who work at them.

For each person we hold their name, their role as the source states it, and a link to a public professional profile. We take this from the organisation’s own website, from public company registers, and from search results for public professional profiles that confirm a person’s name and the firm they work for. Every fact is stored with its source and the date we last confirmed it.

We do not hold a private address, a phone number, a photograph, a date of birth, a nationality, or any assessment or opinion about a person. Where a public register also publishes those, we do not take them.

Our lawful basis is legitimate interests. Founders need to know who funds companies like theirs, the information is professional and already published, and the limits above are how we balance that against the interests of the people named.

These are the companies that process data on our behalf. We share it with them under contract, only as far as running the Services needs it.

• Hosting and storage. Google Cloud Platform (London) runs our application and stores uploaded files. Supabase (EU) provides our database and sign-in. MongoDB Atlas (UK and EU) stores the funding directory and conversation state.
• AI processing. Microsoft Azure and Google Cloud (Vertex AI) host the models that process your content.
• Web research. When researching public information we send queries, such as your company name or an investor’s name, to search and page-reading providers including Exa, Jina and Parallel. We do not send them your uploaded documents.
• Payments. Stripe.
• Email. Amazon SES.
• Support. Intercom powers our in-app support chat.
• This website. Vercel hosts it and provides cookieless analytics.

Your data is stored in UK and EU regions. Where a provider processes data outside the UK or EU we rely on UK-approved Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or an adequacy decision, under Articles 45 and 46.

When you delete your account

We delete what you gave us: your materials, your record, your conversations, your pipeline and your notes. Information we extracted about your company from public sources stays in the funding directory, because it did not come from you and is held on the basis described in Section 7. Records we have to keep by law, such as billing, are kept for the statutory period.

If your own name appears in the directory and you want it removed, that is a separate request under Section 7.

• Authentication. Sign-in through LinkedIn, Google, or a one-time email code. We never store passwords.
• Encryption. Data is encrypted in transit and at rest.
• Access control. Role-based access, least privilege, and logged administrative access.
• Documents. Downloads are served through short-lived signed links, and access is logged.
• Infrastructure. Google Cloud and Supabase, with private networking for internal data stores.
• Monitoring. Error and security monitoring, with regular internal reviews.

No system is completely secure. If a breach affects your data we will tell you and the ICO as the law requires.

• Strictly necessary. Session and sign-in cookies, and your cookie preference itself. These need no consent.
• Website analytics. This website uses Vercel Analytics, which is cookieless and does not track you across sites.
• Support chat. If you open the in-app support chat, Intercom sets the cookies it needs to run the conversation.

Inside the signed-in product we keep server-side usage logs, recording the endpoint, the time and the signed-in user, for security and performance. That is processed under our legitimate interests and needs no cookies.

You can change your preference through the cookie notice shown on your first visit.

You have the right to:

• Access your personal data
• Correct data that is wrong
• Erase your data
• Restrict or object to processing
• Receive a copy in a machine-readable format
• Withdraw consent at any time
• Complain to the Information Commissioner’s Office at ico.org.uk

To exercise any of these, email privacy@platvix.com. We answer within one month.

We may update this policy. Changes are posted on this page, and we will email you at least 30 days before a material change takes effect.